Researchers at the University of Michigan built a tool called MVPNalyzer to do something nobody had done at scale before: audit hundreds of Android VPN apps for what they actually do on your network, not what they claim to do. They ran it against 281 popular VPN apps from the Play Store. The results, presented at the NDSS 2026 Symposium, are the closest thing the mobile VPN market has had to an independent report card, and most of it fails.
This is not a story about NordVPN, Proton VPN, or the other audited providers we cover on this site. It is a story about the much larger pile of free and obscure VPN apps sitting one search away from them on the Play Store, wearing the same three letters on their icon.
What MVPNalyzer actually measured
Auditing a VPN properly means more than reading its privacy policy. MVPNalyzer inspected apps across multiple layers at once: the network traffic leaving the device, the DNS requests being made, the configuration files controlling encryption, and the identifiers sent to outside servers. That combination is what makes the study different from a marketing claim. It checked what left the phone, not what the app said would happen.
Lead author Roya Ensafi, an associate professor at Michigan’s College of Engineering, put the motivation plainly: “Our motivation comes from seeing how many people rely on VPNs for privacy and security, while many apps fail to uphold even basic protections. We want to make it possible for users, regulators and researchers to see what’s actually happening under the hood, so they can make informed choices and pressure industry to do better.”
Co-author Aaron Ortwein, a doctoral student on the project, framed the goal in terms of accountability: “By automating analysis across network layers and configurations, we can uncover vulnerabilities affecting millions of users and hold app developers accountable.”
The numbers that matter
Here is what 281 apps looked like once someone actually checked:
- 29 apps leaked DNS traffic and browser traffic outright, which defeats the entire point of running a VPN.
- More than 20 percent, 61 apps, transmitted sensitive content, including configuration files and traffic that exposed the user’s location, either unencrypted or outside the VPN tunnel entirely.
- More than 60 percent failed to implement basic security hardening.
- 76 apps sent device-specific identifiers, including the Advertising ID, to third parties, enabling persistent tracking and fingerprinting that runs directly against the privacy promises printed on the app store listing.
- Of the 108 apps whose configuration files the researchers could obtain, 107 failed to properly implement recommended encryption standards.
Read that last line twice. Almost every app the team could inspect at the configuration level got the basics wrong. That is not a handful of shady outliers. That is close to the entire sample.
Why a leaking VPN is worse than no VPN
A VPN that leaks DNS or browser traffic is not neutral, it is actively harmful. Users who install these apps believe they are hidden from their ISP, their network operator, or whoever else they are trying to avoid. Instead, they get the false confidence of a lock icon while their requests go out in the clear anyway. Anyone monitoring that traffic sees exactly what they’d see without a VPN installed, except now the user has stopped taking other precautions because they think they are covered.
The advertising ID issue compounds this. An ID meant for ad targeting inside apps becomes a stable fingerprint when a supposedly privacy-focused app hands it to a third party alongside network data. That is the exact opposite of what a VPN app is sold to do, and it is happening in more than a quarter of the apps tested.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
How to spot a VPN that’s lying about what it does
You cannot run MVPNalyzer yourself, but you can apply the same skepticism the researchers did. A few practical filters:
Ignore “unblockable” and “100% anonymous.” No honest VPN promises absolute anonymity. Providers that back their claims with evidence talk about jurisdiction, audit dates, and specific encryption protocols, not superlatives.
Check for a published, dated audit. Not a blog post about “military-grade encryption,” an actual third-party audit report with a firm name, a date, and a scope. We cover exactly how to tell a real one from a marketing exercise in our guide to verifying no-logs claims.
Be wary of free apps with no clear business model. Running VPN server infrastructure costs money. If an app is free, has no subscription tier, and still needs to pay for bandwidth somewhere, that money is probably coming from your data. Our breakdown of free versus paid VPNs goes into which free options are actually safe and which aren’t.
Look at who built it. A company with a public office, a track record, and something to lose in a lawsuit behaves differently than an anonymous developer account with a generic name and a handful of nearly identical apps.
Check permissions requested. A VPN app asking for contacts, camera, or SMS access has no technical reason to need any of it.
None of this requires special tools. It requires treating “VPN” as a category that includes both audited, professionally run services and apps that a developer uploaded last month with zero independent verification of anything they claim.
What this changes for the providers worth using
This study is not an indictment of the VPN industry as a whole, and treating it that way would be a mistake. The providers we recommend on this site have gone through independent, named audits, specifically because claims without verification are worthless, as this research just demonstrated at scale. NordVPN and Proton VPN have both published audit results tied to named security firms, which is the entire distinction this study draws a line under.
The gap the researchers found is not really a gap in VPN technology. WireGuard and OpenVPN, correctly configured, do not leak DNS traffic. The gap is between providers who get audited and hold themselves accountable, and providers who slap “VPN” on an app, skip the engineering work, and rely on the fact that almost nobody checks.
What to actually do with this
If you’re currently using a free or unfamiliar VPN app from the Play Store, this is a reasonable moment to check its permissions, search for its name alongside “audit,” and see if anything comes up. If nothing does after a few years on the market, that silence is itself information.
If you’re picking a VPN for the first time, skip the apps promising the moon and start from providers that can point to a dated, named audit. It is a five-minute check that the vast majority of the 281 apps in this study would have failed.
This is one of the most useful pieces of independent VPN research to come out this year, precisely because it measured behavior instead of reading marketing copy. The takeaway isn't that VPNs don't work. It's that most of the ones people actually install have never been checked by anyone qualified to check them. Stick to providers with a named, dated, public audit, and treat every unverified claim on a Play Store listing as exactly that: unverified.
Sources: University of Michigan College of Engineering | Tech Xplore